cURL Command Cheatsheet

Q: What's the difference between curl and wget?

curl focuses on request flexibility: supports virtually every protocol (HTTP/HTTPS/FTP/SMTP etc.), all HTTP methods, custom headers, cookie management, authentication schemes — it's the go-to tool for API testing. wget focuses on downloads: recursive downloading, resume support, auto-retry. In short: use curl for API debugging, use wget for file downloads.

Q: How do I hide the progress bar in curl?

Use `-s` (silent) to hide both the progress bar and errors. Use `-sS` to hide the progress bar but still show errors. Use `-v` (verbose) or `--trace` to see the full request/response details.

Q: How do I set timeouts in curl?

Two timeout parameters: `--connect-timeout 10` sets the connection timeout (seconds), preventing DNS or TCP handshake hangs; `--max-time 30` sets the maximum total time for the entire request, including data transfer. It's recommended to set both.

Q: How do I handle SSL certificate errors in curl?

For test environments, use `-k` or `--insecure` to skip certificate verification. For production, either use properly configured certificates or specify a CA bundle with `--cacert`. Note: `-k` is a security risk — development/testing only.

cURL is a command-line network transfer tool, pre-installed on virtually every Linux and macOS system. This cheatsheet covers the most commonly used curl commands — from basic GET requests to advanced proxy configuration and debugging tips — each with practical examples. Whether you're debugging APIs or batch-downloading files, this guide has you covered.

Updated: 2026-07-16·40 commands

Quick Reference

Task

Command

Send a GET request	`curl https://api.example.com`
Send a POST request	`curl -X POST -d 'key=val' URL`
Set a header	`curl -H "Authorization: Bearer TOKEN" URL`
Download a file	`curl -O url` or `curl -o output url`
Debug request process	`curl -v URL`
Send JSON data	`curl -X POST -H 'Content-Type: application/json' -d '{"key":"val"}' URL`
Upload a file	`curl -F "file=@photo.jpg" URL`
Use a proxy	`curl -x http://proxy:8080 URL`

Request Methods

``bash # GET request (default) curl https://api.github.com/users/octocat

# POST request curl -X POST https://httpbin.org/post \ -d "username=alice&password=secret"

# POST with JSON curl -X POST https://httpbin.org/post \ -H "Content-Type: application/json" \ -d '{"name":"Alice","email":"alice@example.com"}'

# PUT request (update resource) curl -X PUT https://api.example.com/users/1 \ -H "Content-Type: application/json" \ -d '{"name":"Alice Updated"}'

# DELETE request curl -X DELETE https://api.example.com/users/1

# PATCH request (partial update) curl -X PATCH https://api.example.com/users/1 \ -H "Content-Type: application/json" \ -d '{"email":"new@example.com"}'

# HEAD request (response headers only) curl -I https://example.com

# OPTIONS request (see supported methods) curl -X OPTIONS https://api.example.com -i`

`Headers`

`bash # Set a custom header curl -H "Accept: application/json" https://api.example.com

# Multiple headers curl -H "Accept: application/json" \ -H "Authorization: Bearer token123" \ -H "X-Custom-Header: custom-value" \ https://api.example.com

# Set User-Agent curl -A "Mozilla/5.0 (Linux; Android 13) Chrome/120" \ https://example.com

# Set Referer curl -e "https://google.com" https://example.com

# Include response headers in output (-i) curl -i https://example.com

# View response headers only (-I sends HEAD request) curl -I https://example.com

# Custom Cookie header curl -H "Cookie: sessionId=abc123; theme=dark" \ https://example.com

# Range request (download partial content) curl -r 0-1023 https://example.com/file.zip`

`Authentication`

`bash # Basic Auth (username:password) curl -u "alice:password123" https://api.example.com/secure

# Basic Auth (prompt for password, more secure) curl -u "alice" https://api.example.com/secure

# Bearer Token (JWT / OAuth2) curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9..." \ https://api.example.com/protected

# Digest Authentication curl --digest -u "alice:password" \ https://api.example.com/digest-auth

# .netrc file authentication # In ~/.netrc add: # machine api.example.com login alice password secret curl -n https://api.example.com/secure

# Client Certificate (mTLS) curl --cert client.pem --key client-key.pem \ https://api.example.com/mtls

# OAuth2 Client Credentials flow curl -X POST https://auth.example.com/oauth/token \ -d "grant_type=client_credentials" \ -d "client_id=myapp" \ -d "client_secret=mysecret"

# API Key (query parameter) curl "https://api.example.com/data?api_key=sk-xxxxx"`

`File Upload`

`bash # Upload file via form (multipart/form-data) curl -F "file=@report.pdf" \ -F "title=Annual Report" \ https://api.example.com/upload

# Upload file with MIME type curl -F "image=@photo.jpg;type=image/jpeg" \ https://api.example.com/upload

# PUT upload (raw binary) curl -T report.pdf \ -H "Content-Type: application/pdf" \ https://api.example.com/documents/report.pdf

# Download file (preserve original name) curl -O https://example.com/file.zip

# Download file (specify output name) curl -o output.txt https://example.com/data.json

# Resume download curl -C - -O https://example.com/large-file.iso

# Rate limit download speed curl --limit-rate 1M -O https://example.com/big-file.zip

# FTP upload curl -T file.txt ftp://ftp.example.com/upload/ \ --user "alice:password"

# FTP download curl ftp://ftp.example.com/file.txt --user "alice:password"

# Large file download (follow redirects) curl -L -O https://example.com/latest-release.tar.gz`

`Debug & Diagnostics`

`bash # Verbose mode (view request and response headers) curl -v https://api.example.com

# Trace full request (including SSL handshake) curl --trace-ascii trace.log https://api.example.com

# Binary trace (most detailed debug mode) curl --trace trace.bin https://api.example.com

# Time statistics with -w curl -w "\nTime breakdown:\n\ DNS lookup: %{time_namelookup}s\n\ TCP connect: %{time_connect}s\n\ TLS handshake: %{time_appconnect}s\n\ TTFB: %{time_starttransfer}s\n\ Total time: %{time_total}s\n\ Downloaded: %{size_download} bytes\n\ HTTP status: %{http_code}\n" \ -o /dev/null -s https://api.example.com

# Connection timeout curl --connect-timeout 10 --max-time 30 \ https://example.com

# Silent mode (no progress bar or errors) curl -s https://api.example.com

# Silent but show errors curl -sS https://api.example.com

# Get HTTP status code only curl -s -o /dev/null -w "%{http_code}" \ https://api.example.com

# Follow redirects (max 5) curl -L --max-redirs 5 https://httpbin.org/redirect/3

# Skip SSL verification (dev/test only) curl -k https://self-signed.example.com

# Specify CA certificate file curl --cacert /path/to/ca-bundle.crt \ https://api.example.com

# Specify TLS version curl --tlsv1.2 https://secure.example.com

# Custom DNS resolution (bypass DNS) curl --resolve "example.com:443:127.0.0.1" \ https://example.com

# Health check (status code only) curl -s -o /dev/null -w "%{http_code}" \ https://api.example.com/health`

`Cookie Management`

`bash # Send Cookie as header curl -H "Cookie: session=abc123; user=alice" \ https://example.com

# Save server Set-Cookie to file (cookie jar) curl -c cookies.txt https://example.com/login

# Load cookies from file and send curl -b cookies.txt https://example.com/dashboard

# Save and load cookies simultaneously (session persistence) curl -c cookies.txt -b cookies.txt \ https://example.com/login

# Login then use cookie for subsequent requests curl -c session.txt -X POST \ -d "username=alice&password=secret" \ https://api.example.com/auth/login

curl -b session.txt \ https://api.example.com/user/profile

# Ignore cookies (don't persist any) curl --no-cookie https://example.com

# Empty cookie (send empty Cookie header) curl -b "NONE" https://example.com`

`Proxy Configuration`

`bash # HTTP proxy curl -x http://proxy.example.com:8080 \ https://api.example.com

# HTTPS proxy curl -x https://proxy.example.com:443 \ https://api.example.com

# SOCKS5 proxy curl --socks5 127.0.0.1:1080 \ https://api.example.com

# SOCKS5 with DNS resolution through proxy curl --socks5-hostname 127.0.0.1:1080 \ https://api.example.com

# SOCKS4 proxy curl --socks4 127.0.0.1:1080 \ https://api.example.com

# Authenticated proxy curl -x http://proxy.example.com:8080 \ --proxy-user "user:password" \ https://api.example.com

# Bypass proxy (direct connection) curl --noproxy "localhost,127.0.0.1,*.local" \ https://api.example.com

# Use proxy from environment variables # export http_proxy=http://proxy:8080 # export https_proxy=http://proxy:8080 curl https://api.example.com

# Ignore environment proxy settings curl --noproxy "*" https://api.example.com``

Request Methods(7)

Command	Level	Example
`curl <url>` Send a GET request (default method)	Basic	`curl https://api.github.com/users/octocat`
`curl -X POST` Send a POST request	Basic	`curl -X POST https://httpbin.org/post -d "key=val"`
`curl -X PUT` Send a PUT request (update a resource)	Intermediate	`curl -X PUT https://api.example.com/users/1 -d "{\"name\":\"Alice\"}"`
`curl -X DELETE` Send a DELETE request	Intermediate	`curl -X DELETE https://api.example.com/users/1`
`curl -X PATCH` Send a PATCH request (partial update)	Intermediate	`curl -X PATCH https://api.example.com/users/1 -d "{\"email\":\"new@example.com\"}"`
`curl -I` Send a HEAD request (response headers only)	Basic	`curl -I https://example.com`
`curl -X OPTIONS` Send an OPTIONS request (see supported methods)	Intermediate	`curl -X OPTIONS https://api.example.com -i`

Headers(4)

Command	Level	Example
`curl -H` Set a custom request header	Basic	`curl -H "Accept: application/json" https://api.example.com`
`curl -A` Set the User-Agent header	Basic	`curl -A "Mozilla/5.0 (Linux; Android 13)" https://example.com`
`curl -e` Set the Referer header	Intermediate	`curl -e "https://google.com" https://example.com`
`curl -i` Include response headers in output	Basic	`curl -i https://example.com`

Authentication(4)

Command	Level	Example
`curl -u` HTTP Basic authentication	Basic	`curl -u "alice:password123" https://api.example.com/secure`
`curl -H "Authorization: Bearer <token>"` Bearer Token authentication (JWT / OAuth2)	Intermediate	`curl -H "Authorization: Bearer eyJhbGci..." https://api.example.com/protected`
`curl --digest` HTTP Digest authentication	Intermediate	`curl --digest -u "alice:password" https://api.example.com/digest-auth`
`curl -n` Use .netrc file for authentication	Intermediate	`curl -n https://api.example.com/secure`

File Upload(8)

Command	Level	Example
`curl -F` Multipart form file upload	Intermediate	`curl -F "file=@report.pdf" -F "title=Report" https://api.example.com/upload`
`curl -T` PUT file upload (raw binary content)	Intermediate	`curl -T report.pdf -H "Content-Type: application/pdf" https://api.example.com/doc.pdf`
`curl -O` Download file preserving the original filename	Basic	`curl -O https://example.com/file.zip`
`curl -o` Download file with a custom output filename	Basic	`curl -o output.txt https://example.com/data.json`
`curl -C -` Resume a download	Intermediate	`curl -C - -O https://example.com/large-file.iso`
`curl --limit-rate` Limit download/upload speed	Intermediate	`curl --limit-rate 1M -O https://example.com/big-file.zip`
`curl -T ftp://` Upload file via FTP	Intermediate	`curl -T file.txt ftp://ftp.example.com/ --user "alice:password"`
`curl -L -O` Follow redirects while downloading	Basic	`curl -L -O https://example.com/latest-release.tar.gz`

Debug(8)

Command	Level	Example
`curl -v` Verbose mode — show request and response headers	Basic	`curl -v https://api.example.com`
`curl --trace-ascii` Trace request details (including SSL handshake)	Intermediate	`curl --trace-ascii trace.log https://api.example.com`
`curl -w` Custom output format (time statistics, etc.)	Intermediate	`curl -w "%{http_code} %{time_total}s" -o /dev/null -s https://example.com`
`curl --connect-timeout --max-time` Set connection timeout and max request time	Intermediate	`curl --connect-timeout 10 --max-time 30 https://example.com`
`curl -s / -sS` Silent mode (hide progress bar)	Basic	`curl -sS https://api.example.com`
`curl -k` Skip SSL certificate verification (dev/test only)	Intermediate	`curl -k https://self-signed.example.com`
`curl -L --max-redirs` Follow redirects with a max redirect limit	Intermediate	`curl -L --max-redirs 5 https://httpbin.org/redirect/3`
`curl --resolve` Custom DNS resolution (force IP address)	Expert	`curl --resolve "example.com:443:127.0.0.1" https://example.com`

Cookies(4)

Command	Level	Example
`curl -c <file>` Save Set-Cookie headers to a cookie jar file	Intermediate	`curl -c cookies.txt https://example.com/login`
`curl -b <file>` Read cookies from file and send them	Intermediate	`curl -b cookies.txt https://example.com/dashboard`
`curl -c <file> -b <file>` Cookie session persistence (read and write simultaneously)	Intermediate	`curl -c session.txt -b session.txt -d "user=alice&pass=secret" https://api.example.com/login`
`curl --no-cookie` Ignore cookies (don't save or send)	Intermediate	`curl --no-cookie https://example.com`

Proxy(5)

Command	Level	Example
`curl -x <proxy>` Use an HTTP/HTTPS proxy	Intermediate	`curl -x http://proxy.example.com:8080 https://api.example.com`
`curl --socks5` Use a SOCKS5 proxy	Intermediate	`curl --socks5 127.0.0.1:1080 https://api.example.com`
`curl --socks5-hostname` Use SOCKS5 proxy with DNS resolution through proxy	Intermediate	`curl --socks5-hostname 127.0.0.1:1080 https://api.example.com`
`curl --proxy-user` Authenticated proxy connection	Intermediate	`curl -x http://proxy:8080 --proxy-user "user:pass" https://api.example.com`
`curl --noproxy` Bypass proxy for specific domains (direct connection)	Intermediate	`curl --noproxy "localhost,127.0.0.1,*.local" https://api.example.com`

FAQ

What's the difference between curl and wget?

How do I hide the progress bar in curl?

How do I set timeouts in curl?

How do I handle SSL certificate errors in curl?

This cheatsheet is compiled from official tool documentation. Last updated: 2026-07-16.